feat: Oxtools Code Security Scanner V2 and Json to Schema V2 with Benchmarks

[ms-shashank]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
oxtools	Ready	Preview, Comment	Apr 27, 2026 4:14pm

[github-actions]

🤖 OxBot AI Review

⚠️ AI review unavailable: Azure AI credentials not configured.

---

_{Powered by Kimi K2.6 via Azure Foundry | [Oxtools AI Review Agent]}

[github-actions]

OxBot Review

1. Summary — This PR introduces OxBot, an AI-powered PR review agent using Kimi K2.6 via Azure Foundry. It also adds two new Tier 2 agentic tools (code-security-scanner-v2, json-to-schema-v2), implements a new files input type with ZIP/folder upload support, fixes Next.js streaming timeouts for long-running tools, adds a pipeline log viewer, and resolves hydration mismatches in the tool execution UI.

2. Security —

   • ✅ No hardcoded secrets or credentials in the diff.
   • ✅ sanitize_diff() in .github/scripts/ai_pr_review.py redacts AWS keys, GitHub PATs, OpenAI keys, and generic secrets before sending data to the LLM.
   • ⚠️ The new files input reads file contents client-side and transmits them to the backend. Ensure the Python tool runner re-validates file types, size limits, and ZIP contents server-side (defense in depth).

3. Code Quality —

   • ⚠️ Performance: app/src/components/result-viewer.tsx splits and scans the result string on every render (lines ~274–290). During streaming, this causes unnecessary re-computation per chunk.
   • ⚠️ Logic mismatch: app/src/app/api/tools/[toolId]/route.ts sets maxDuration = 300 (5 min) but uses AbortSignal.timeout(600_000) (10 min). On Vercel, the function will be killed at 300s anyway, leaving the fetch promise dangling.
   • ⚠️ Duplication: app/src/app/tools/[toolId]/page.tsx duplicates file path cleaning, extension filtering, and size validation logic between the file picker and folder picker handlers.
   • ⚠️

---

_{Automated code review by OxBot}

[github-actions]

OxBot Review

1. Summary — This PR introduces two new tier2 agentic tools (Code Security Scanner V2 and JSON to Schema V2), adds multi-file/ZIP upload support to the frontend, fixes Next.js stream buffering and hydration issues for long-running executions, and adds an AI PR review bot (OxBot) via GitHub Actions.

2. Security — ⚠️ Concerns found:

   • .github/scripts/ai_pr_review.py:42 and 55: urllib.request.urlopen calls in github_api and get_pr_diff lack timeouts. A stalled GitHub API connection will hang the CI job indefinitely.
   • .github/scripts/ai_pr_review.py:86-89: sanitize_diff compiles regex patterns on every invocation. While the redaction patterns are reasonable, they should be compiled once at module level for performance and consistency.
   • ✅ No hardcoded secrets, API keys, or dangerous eval/exec patterns in application code.

3. Code Quality — Logic issues and improvements:

   • Breaking Change: app/src/lib/oxlo.ts removes the exported oxloClient singleton. If any other file in the codebase imports it, the build will fail. Verify all usages or preserve backward compatibility.
   • app/src/app/tools/[toolId]/page.tsx: The folder-picker logic hardcodes a 50 file limit and a static extension list instead of respecting config.maxFiles and config.accept. It also excludes extension-less files (e.g., Dockerfile, Makefile, .env without extension) due to the "." + f.name.split(".").pop() logic, which is problematic for a security scanner.
   • app/src/components/result-viewer.tsx:336: Log line mapping uses key={i}, which conflicts with the newly enabled Biome noArrayIndexKey rule.
   • app/next.config.ts:6-13: The rewrite for /api/tools-stream/:toolId appears unused—the frontend bypasses Next.js entirely for tier2 tools by calling the runner URL directly. Remove if dead code.
   • ✅ Good fix for hydration mismatch using deferred mounted state.
   • ✅ Correct active stream piping in route.ts to prevent Next.js from silently closing long-lived responses.

4. Suggestions — Actionable improvements:

   • app/src/lib/oxlo.ts:4-12 — Re-export oxloClient (e.g., export const oxloClient = getOxloClient()) or audit the codebase for existing imports to prevent build breaks.
   • .github/scripts/ai_pr_review.py:42,55 — Add timeout=30 (seconds) to all urllib.request.urlopen calls.
   • .github/scripts/ai_pr_review.py:86 — Move regex patterns to module-level compiled constants: RE_AWS_KEY = re.compile(r'...').
   • app/src/app/tools/[toolId]/page.tsx:442 — Replace hardcoded 50 with config.maxFiles || 50.
   • app/src/app/tools/[toolId]/page.tsx:456-460 — Allow extension-less filenames or derive allowed extensions from config.accept dynamically instead of a hardcoded Set.
   • app/src/components/result-viewer.tsx:336 — Use a composite key like `${i}-${line.slice(0, 16)}` or suppress the rule; alternatively, since logs are append-only, the index is semantically safe but will trigger lint warnings.
   • app/next.config.ts:6-13 — Either document the intended consumer of the /api/tools-stream rewrite or remove it to reduce confusion.

5. Verdict — ⚠️ NEEDS CHANGES

Address the missing network timeouts in the CI script and confirm the oxloClient export removal does not break existing imports before merging.

---

_{Automated code review by OxBot}

[github-actions]

OxBot Review

Review unavailable: API credentials not configured.

---

_{Automated code review by OxBot}